Competitive Audits
First Flights
Leaderboard
Docs
Toggle theme
Sign up
Log in
All First Flights
Snowman Merkle Airdrop
Submissions
First Flights
Snowman Merkle Airdrop
First Flight #42
Beginner Friendly
Foundry
Solidity
NFT
100
EXP
First Flights
100
EXP
Jun 12th, 2025 → Jun 19th, 2025
View repo
525 / 525
Submissions
Severity
Tags
#1
Unused error initialization increases gas cost
Low
#2
Unused state variable increases gas costs
Low
#3
Anyone can mint unlimited number of tokens to any address.
High
#4
Missing Claim Duplication Prevention in `claimSnowman()` Function of `SnowmanAirdrop.sol` Allowing Multiple Token Transfers and NFT Mints
High
#5
Signature verification uses dynamic balance instead of static signed amount, breaking EIP-712 logic in `claimSnowman()`
Medium
#6
Unconsistent `MESSAGE_TYPEHASH` with standart EIP-712 declaration on contract `SnowmanAirdrop`
High
#7
Global Timer on earnSnow() Enables Denial of Service
High
#8
roken EIP-712 Signature Recovery
High
#9
No Replay Protection / Idempotency
High
#10
Unrestricted NFT Minting in Snowman.sol
High
#11
Global `s_earnTimer` in `Snow::earnSnow` restricts earning to a single user per week
High
#12
One global s_earnTimer.
Medium
#13
Missing access control on mintSnowman
High
#14
`earnSnow()` uses a global timer instead of per-user tracking, allowing Sybil-based inflation of Snow token supply
Medium
#15
Double Payment and ETH Theft Vulnerability in Snow::buySnow Function
High
#16
Unrestricted Minting in Snowman Contract
High
#17
Global Timer Reset in Snow::buySnow Denies Free Claims for All Users
High
#18
`buySnow()` payment check unclear — accepts exact ETH or else assumes WETH transfer; no validation if user sends incorrect msg.value.
High
#19
Lack of Validation signature only claimed once on `claimSnowman` lead to Replays Attacks
High
#20
Precision Handling Mismatch Causes Economic Model Failure
High
#21
Global Timer Reset in `Snow::earnSnow` Disables Free Weekly Claims for All Users
High
#22
`mintSnowman()` in `Snowman.sol` lacks access control, allowing arbitrary NFT minting by any external caller
High
#23
Improper Access Control in earnSnow() Leads to Token Distribution Exploit
High
#24
`tokenURI()` incorrectly checks ownership using `ownerOf()` instead of `_exists()`, causing unnecessary reverts
Medium
#25
Incorrect EIP-712 TypeHash Prevents Signature Verification in SnowmanClaim
Low
#26
Non-deterministic JSON key ordering in `GenerateInput.s.sol` breaks Merkle root reproducibility and trust in off-chain claim validation
Medium
#27
`SnowmanAirdrop::claimSnowman` Function Allows Unauthorized Token Transfers
High
#28
Incorrect Signature Validation in SnowmanAirdrop Contract
High
#29
Merkle Proof Malleability
Medium
#30
ETH/WETH Handling in buySnow
Medium
Previous
1
2
3
...
More pages
18
Next
Support
FAQs
Can't find an answer? Chat with us on Discord, Twitter or Linkedin.
What is Cyfrin CodeHawks?
What is a competitive audit?
How can I host a competition on CodeHawks?
How is a contest prize pool determined?
How do I get rewarded?
What is a First Flight?
Give us feedback!
